High 7.5Published Mar 18, 2026

CVE-2025-71268btrfs: fix reservation leak in some error paths when inserting inline extent

Updated under an hour ago (Oct 27, 2026, 6:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the reserved qgroup data, resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data() in such cases.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-772
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 94ed938aba557aa798acf496f09afb289b619fcd before f7156512c8166d385f574b9ec030479aa7b1e8c9; 94ed938aba557aa798acf496f09afb289b619fcd builds before 28b97fcbbf523779688e8de5fe55bf2dae3859f6; from 94ed938aba557aa798acf496f09afb289b619fcd before f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913; from 94ed938aba557aa798acf496f09afb289b619fcd before 28768bd3abf9995a93f6e01bfce01c60622964dd; from 94ed938aba557aa798acf496f09afb289b619fcd before c1c050f92d8f6aac4e17f7f2230160794fceef0c	CNA record
linux linux_kernel linux:linux_kernel	from 4.4 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; 6.19; 6.19	NVD

References

References

https://git.kernel.org/stable/c/f7156512c8166d385f574b9ec030479aa7b1e8c9	patch
https://git.kernel.org/stable/c/28b97fcbbf523779688e8de5fe55bf2dae3859f6	patch
https://git.kernel.org/stable/c/f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913	patch
https://git.kernel.org/stable/c/28768bd3abf9995a93f6e01bfce01c60622964dd	patch
https://git.kernel.org/stable/c/c1c050f92d8f6aac4e17f7f2230160794fceef0c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.